SCS-C02 Practice Test 48 — 15 Questions

Question 1

A startup is deploying a web application on AWS. The application runs on EC2 instances behind an Application Load Balancer (ALB). The security team wants to ensure that all traffic to the EC2 instances is encrypted. They configure the ALB to listen on HTTPS (port 443) and forward traffic to the EC2 instances on HTTP (port 80). Additionally, they create a security group for the EC2 instances that only allows inbound traffic from the ALB's security group on port 80. However, a security audit reveals that the traffic between the ALB and EC2 instances is not encrypted. Which step should the security team take to encrypt the traffic between the ALB and EC2 instances?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the target group to use HTTPS protocol and install a certificate on the EC2 instances.. To encrypt traffic between the ALB and EC2 instances, configure the target group to use HTTPS protocol and install a certificate on the EC2 instances. This ensures the ALB sends HTTPS requests to the instances, encrypting the traffic. Option A is wrong because opening port 443 on the EC2 security group alone does not enable encryption; the listener must also use HTTPS for target traffic. Option B is wrong because encryption at rest protects data stored on disk, not data in transit. Option D is wrong because changing the ALB listener to TCP would terminate TLS at the ALB and forward unencrypted traffic to the targets, which defeats the purpose.

Answer

Update the EC2 security group to allow traffic on port 443 from the ALB.

Answer

Enable encryption at rest on the EC2 instances.

Answer

Change the ALB listener to use TCP instead of HTTPS.

Question 2

Refer to the exhibit. A security engineer reviews the bucket policy for an S3 bucket. The engineer attempts to upload an object to the bucket using the AWS CLI without the --ssl flag (HTTP). What is the outcome?

Accepted Answer

The upload fails because the policy denies requests that are not using HTTPS.. The bucket policy includes a condition that explicitly denies all s3: actions (including s3:PutObject) when the request does not use HTTPS (SecureTransport is false). Since the engineer uses HTTP (no --ssl flag), the condition is met, and the upload is denied. Option A is incorrect because the policy does not allow all actions; it includes a conditional deny. Option C is incorrect because default encryption does not override the explicit deny in the policy. Option D is incorrect because the policy denies all s3 actions, not just s3:PutObject.

Answer

The upload succeeds because the policy allows all actions.

Answer

The upload succeeds because the bucket has default encryption enabled.

Answer

The upload fails because the policy denies s3:PutObject only.

Question 3

A company needs to encrypt data in transit between an EC2 instance and an RDS database. Which option should be used?

Accepted Answer

Configure the database to use SSL/TLS connections. Encrypting data in transit between an EC2 instance and an RDS database requires the use of SSL/TLS protocols to secure the communication channel. AWS RDS supports SSL/TLS connections by enabling the `require_secure_transport` parameter or using a certificate bundle on the client side, ensuring that all data transmitted over the network is encrypted and protected from eavesdropping or man-in-the-middle attacks.

Answer

Enable encryption at rest for the RDS instance

Answer

Use an AWS KMS key to encrypt the connection

Answer

Enable EBS encryption on the EC2 instance

Question 4

A company uses AWS Organizations to manage multiple accounts. The security team must enforce that all Amazon S3 buckets across all accounts are encrypted with AWS KMS. The team has enabled S3 default encryption for new buckets, but existing buckets may not be encrypted. They need to automatically remediate any non-compliant buckets. The team has AWS Config and AWS Lambda available. What is the MOST operationally efficient solution?

Accepted Answer

Use AWS Config with the s3-bucket-server-side-encryption-enabled rule and configure an AWS Systems Manager Automation document to remediate non-compliant buckets.. Use AWS Config with the s3-bucket-server-side-encryption-enabled rule to detect non-compliant S3 buckets. Then configure an automatic remediation action using an AWS Systems Manager Automation document to enable encryption on those buckets. This approach is serverless, automated, and operationally efficient as it does not require manual intervention or separate compute resources.

Answer

Manually review all buckets using the S3 console and enable encryption for those that are not encrypted.

Answer

Write a script that runs daily on an EC2 instance to list all buckets and enable encryption on any that are not encrypted.

Answer

Use AWS Trusted Advisor to check for unencrypted buckets and send an SNS notification to the security team to manually remediate.

Question 5

Match each AWS service to its primary security function.

Accepted Answer

AWS WAF: Web application firewall that protects against common web exploits.. These are core AWS security services with distinct purposes.

Answer

AWS WAF: Managed DDoS protection service.

Answer

AWS Shield: Threat detection service.

Question 6

A company wants to monitor unauthorized API calls in their AWS account. Which TWO AWS services can provide real-time alerting on such events?

Accepted Answer

AWS CloudTrail. AWS CloudTrail (B) is correct because it records every API call made in the account as management and data events, and when combined with CloudWatch Logs metric filters and alarms it delivers real-time alerting on unauthorized or suspicious API activity. Amazon GuardDuty (C) is correct because it continuously analyzes CloudTrail management events, VPC Flow Logs, and DNS logs with threat intelligence and machine learning to detect anomalous or unauthorized API calls and generate findings in near real time. AWS Config (A) is not designed for real-time alerting on API calls; it evaluates resource configuration compliance and records configuration changes, not API invocation events. AWS Trusted Advisor (D) provides periodic best-practice checks and recommendations, not real-time monitoring of API activity. Amazon Inspector (E) is a vulnerability management service that scans EC2 instances, container images, and Lambda functions for software vulnerabilities and network exposure, not API call monitoring.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 7

A company uses AWS CloudTrail to log API activity. The security team wants to ensure that any modification to CloudTrail configuration is logged and that the logs are tamper-proof. Which feature should be enabled?

Accepted Answer

CloudTrail Log File Integrity Validation. CloudTrail Log File Integrity Validation (option C) uses a hash chain and digital signatures (SHA-256 hashing with RSA) to verify that log files have not been modified, deleted, or tampered with after delivery to the S3 bucket. This feature creates a digest file that contains the hash of each log file, and the digest files themselves are signed, enabling the security team to detect any unauthorized changes to CloudTrail configuration logs.

Answer

S3 MFA Delete on the CloudTrail S3 bucket

Answer

S3 Versioning on the CloudTrail S3 bucket

Answer

CloudWatch Logs log stream encryption

Question 8

A company has a multi-account AWS environment using AWS Organizations. The security team wants to ensure that all API activity across all accounts is logged and immutable. CloudTrail is enabled in all accounts, but the logs are stored in individual account buckets. The team wants to centralize logs and prevent any account from disabling logging. What should they do?

Accepted Answer

Apply an SCP to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail, and create an organization trail that delivers logs to a central S3 bucket with a bucket policy that prevents deletion.. It uses an SCP to prevent disabling CloudTrail (denying cloudtrail:StopLogging and cloudtrail:DeleteTrail) and creates an organization trail that delivers logs to a central S3 bucket. The central bucket policy prevents deletion of logs, ensuring immutability and centralized logging across all accounts in the AWS Organization.

Answer

Create a new CloudTrail trail for each account and configure S3 bucket policies to allow cross-account access.

Answer

Enable S3 MFA Delete on each account's log bucket and require MFA for IAM users.

Answer

Use CloudWatch Logs to aggregate logs and set a retention policy of 10 years.

Question 9

A company is designing a data protection solution for Amazon S3 that must prevent any user from accidentally deleting objects. Which combination of S3 features should be used?

Accepted Answer

Enable S3 Versioning and MFA Delete.. Enabling S3 Versioning preserves all object versions, allowing recovery of deleted objects, and MFA Delete requires multi-factor authentication for permanent deletions, preventing accidental or unauthorized deletions. Option A is wrong because Cross-Region Replication copies objects to another bucket but does not prevent deletion of the source objects. Option B is wrong because Object Lock with governance mode prevents overwrites and deletions only if a retention period is set, but it does not block deletion of the bucket itself or version-level deletions if the lock is not applied. Option C is wrong because default encryption (SSE-KMS) protects data at rest but does not prevent deletion of objects.

Answer

Use S3 Cross-Region Replication to another bucket.

Answer

Enable S3 Object Lock with governance mode.

Answer

Configure S3 default encryption with SSE-KMS.

Question 10

A company wants to receive real-time notifications when specific API calls are made in their AWS account, such as IAM user creation or S3 bucket policy changes. Which AWS service should be used to trigger notifications based on these API events?

Accepted Answer

Amazon CloudWatch Events (Amazon EventBridge). Amazon CloudWatch Events (now part of Amazon EventBridge) is the correct service because it can capture AWS API calls in real time via CloudTrail integration. You can create a rule that matches specific API calls (e.g., CreateUser, PutBucketPolicy) and route those events to a target such as an SNS topic or Lambda function for immediate notification. This provides the real-time, event-driven notification required by the scenario.

Answer

Amazon GuardDuty

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Config

Question 11

Refer to the exhibit. An AWS KMS key policy includes the statement shown. The AdminRole tries to decrypt a ciphertext that was encrypted using the same KMS key with encryption context 'department=engineering'. What will happen?

Accepted Answer

The decrypt operation fails because the encryption context does not match the condition.. The KMS key policy includes a condition that requires the encryption context to be 'department=finance' for decryption. When the AdminRole attempts to decrypt, the encryption context must match both the encryption context used during encryption and any conditions in the key policy. Since the ciphertext was encrypted with 'department=engineering', the decryption fails because the encryption context does not satisfy the policy condition, even though the role has kms:Decrypt permission.

Answer

The decrypt operation succeeds because the role has kms:Decrypt permission.

Answer

The decrypt operation succeeds because the encryption context is ignored during decryption.

Answer

The decrypt operation fails because the policy does not allow kms:Decrypt without matching context.

Question 12

A company wants to allow an external auditor to assume a read-only role in their AWS account. The auditor's AWS account ID is 123456789012. Which trust policy should be attached to the role?

Accepted Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::123456789012:root" },
      "Action": "sts:AssumeRole",
      "Condition": { "Bool": { "aws:MultiFactorAuthPresent": "true" } }
    }
  ]
}. It grants the external auditor's AWS account (via its root principal ARN) permission to assume the read-only role, while enforcing multi-factor authentication (MFA) as a security best practice. The `sts:AssumeRole` action is the standard mechanism for cross-account role assumption, and the `aws:MultiFactorAuthPresent` condition ensures the auditor uses MFA, reducing the risk of compromised credentials.

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::123456789012:root" },
      "Action": "sts:AssumeRole"
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::123456789012:user/Auditor" },
      "Action": "sts:AssumeRole"
    }
  ]
}

Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": { "AWS": "123456789012" },
      "Action": "sts:AssumeRole"
    }
  ]
}

Question 13

Refer to the exhibit. A security engineer reviews the CloudTrail trail configuration. What is a security concern?

Accepted Answer

The logs are not encrypted with a customer-managed KMS key. The security concern is that the CloudTrail logs are not encrypted with a customer-managed KMS key. By default, CloudTrail encrypts log files using SSE-S3 (S3-managed keys), which does not provide the customer with control over key rotation, access policies, or the ability to audit key usage. Using a customer-managed KMS key ensures that only authorized principals can decrypt the logs, and it enables fine-grained access control and audit trails via CloudTrail and CloudWatch Logs, which is critical for compliance and security monitoring.

Answer

The trail is not multi-region

Answer

Log file validation is not enabled

Answer

CloudWatch Logs integration is missing

Question 14

A company wants to monitor failed SSH login attempts to EC2 instances. Which approach should be used?

Accepted Answer

Use the CloudWatch Logs agent to send /var/log/auth.log to CloudWatch Logs. Failed SSH login attempts are logged by the SSH daemon (sshd) to the system's authentication log file, typically /var/log/auth.log on Debian-based systems or /var/log/secure on Red Hat-based systems. The CloudWatch Logs agent can be configured to tail this log file and send the entries to CloudWatch Logs, where you can create metric filters to detect patterns like 'Failed password' and trigger alarms or automated responses.

Answer

Enable AWS CloudTrail for EC2 instances

Answer

Enable VPC Flow Logs

Answer

Use AWS Config to detect SSH access

Question 15

A security team uses Amazon Macie to discover sensitive data in S3. They have configured Macie to run automated sensitive data discovery jobs. After reviewing the findings, they notice that some S3 objects containing personally identifiable information (PII) are not being flagged. What is the most likely cause?

Accepted Answer

The PII is in a format that Macie's managed data identifiers do not recognize, and no custom data identifier is configured.. Macie uses managed data identifiers to detect PII based on predefined patterns. If the PII in the S3 objects is in a format that does not match any of these managed identifiers (e.g., a non-standard date format or a custom ID number), and no custom data identifier has been configured to recognize that specific pattern, Macie will not flag the objects. This is the most likely cause given that the security team has already configured automated discovery jobs and other common issues like permissions or encryption are not preventing scanning.

Answer

The Macie service-linked role does not have permissions to read the objects.

Answer

The S3 bucket is in a different AWS Region than the Macie job.

Answer

The S3 objects are encrypted with SSE-S3.